Apparatuses, system and process for the personal protection

ABSTRACT

An apparatus for the personal protection is described. The apparatus has at least one main control unit which is connected to one or more main sensors and to a first main transceiver for transmitting and receiving on a first radio channel control signals and/or activation signals, wherein the main control unit is also connected to a second main transceiver for transmitting and receiving on a second radio channel control signals and/or activation signals. Vehicles and a system which comprise the apparatus are also described. The vehicles and the system also include a secondary apparatus and a protective garment which can communicate with the apparatus. A process which can be carried out by the system is also described.

CROSS REFERENCE TO RELATED APPLICATIONS

The present application is the US national stage of International PatentApplication PCT/IB2011/054802 filed on Oct. 28, 2011 which, in turn,claims priority to Italian Patent Application MI2010A002026 filed onOct. 29, 2010.

The present invention relates to a system for the personal protection,and in particular a system provided with a main apparatus which cansignal an accident to a secondary apparatus connected to a protectivegarment, for example provided with an airbag, for the activation of thelatter. The present invention also relates to vehicles comprising such amain apparatus and a process which can be carried out by such a system.

WO 2010/037931 discloses a system for the personal protection wherein amain apparatus mounted on a motorcycle comprises a main control unitconnected to two pairs of main 3-axis acceleration sensors and to a maintransceiver for transmitting activation signals on a single radiochannel with a frequency of about 900 MHz to a secondary transceiver ofa secondary apparatus arranged on a protective garment provided with anairbag. Such known system also comprises a testing device which in caseof malfunctions in the main apparatus switches the control unit of themain apparatus from a normal mode to a system fault mode, wherein theprotective garment does not work. The secondary transceiver of thesecondary apparatus may signal the power-on of the secondary apparatusto the main transceiver of the main apparatus, so that the latter candetermine whether the secondary apparatus is off or on. When the maincontrol unit determines an impact of the motorcycle by means of the mainsensors, the main apparatus sends through the main transceiver an airbagactivation signal to the secondary apparatuses.

U.S. Pat. No. 6,018,980 discloses a system to determine if a vehicleside part has been deformed after a side impact, which system comprisesa main apparatus which compares the frequency components of at least twoy-axis acceleration values detected by acceleration sensors arranged indifferent parts of the vehicle body which move due to a deformation ofthe vehicle side part after a side impact.

US 2009.127835 A1 discloses a main apparatus provided with a single3-axis accelerometer which is mounted on a vehicle and is suitable todetect an impact or a slide of this vehicle for inflating an airbaggarment if a threshold value is achieved or exceeded.

Such known systems have reliability problems in case of malfunctions ofa transceiver, of interferences between the main apparatus and thesecondary apparatuses or of impacts along particular directions, withconsequent risks of an undesired activation of the protective garmentsor of a non-activation thereof in case of accident.

It is therefore en object of the present invention to provide a systemfree from said disadvantages. Said object is achieved with an apparatus,a system, a process and other products, whose technical features aredisclosed in the attached claims.

Thanks to the particular bidirectional connection on two differentchannels for sending control signals between two transceivers in themain apparatus and two transceivers in the secondary apparatus, thesystem can also work in case of interferences on one channel and/or ofmalfunctions of a transceiver, especially if the frequency of the firstchannel is on a bandwidth, preferably comprised between 2400 and 2483.5MHz, completely different from the bandwidth of the second channel.

For improving the reliability of the system, one or both the controlunits of the apparatuses comprise dual-core microprocessors, whereineach core controls a transceiver, so that the system can work properly,thanks to a particular process and/or to particular supervision devicesconnected to the control units, also in a degraded mode in which theprotective garments can be activated though the radio connection on onechannel does not work properly.

Particular auxiliary sensors allow, thanks to a particular accidentdetection process, to activate the protective garments not only in caseof impact, with a higher reliability with respect to the known systemsand processes for detecting impacts in personal protection systems, butalso in case of slide of the vehicle, which is advantageous especiallyfor the motorcycles.

For further improving the reliability of the system, smart-cardscontaining particular identification codes can be inserted intosmart-card readers connected to the control units of the secondaryapparatuses, so that these identification codes can be transmitted tothe main apparatuses and recognized by the control units of the latter,so that the users can verify the correct connection between the mainapparatus and one or more secondary apparatuses without the risk ofinterferences with other secondary apparatuses. The identification codespreferably comprise sub-codes which allow to recognize the position ofthe users in the vehicle, for example whether a user is the driver or apassenger, so as to easily distinguish the secondary apparatus havingworking problems form the secondary apparatus which works properly. Withthis arrangement, a smart-card associated to a main apparatus can beinserted into several secondary apparatuses, so that the user can easilychange the protective garment with other protective garments whilekeeping the same vehicle on which the main apparatus is installed.

The secondary apparatuses are preferably provided with vibratingdevices, so as to signal status changes to the user without the userbeing forced to watch a display, so as not to distract him if he drivesa vehicle.

Further advantages and features of the apparatuses, the system and theprocess according to the present invention will become clear to thoseskilled in the art from the following detailed and non-limitingdescription of an embodiment thereof with reference to the attacheddrawings, wherein:

FIG. 1 shows a side view of a vehicle and two users provided with thesystem;

FIG. 2 shows a front view of the vehicle of FIG. 1;

FIG. 3 shows a block scheme of the main apparatus of the system;

FIG. 4 shows a block scheme of the secondary apparatus of the system;and

FIGS. 5 to 10 show flow-charts of the system working.

Referring to FIGS. 1 and 2, it is seen that the system comprises a mainapparatus 1 suitable for transmitting activation signals and/or controlsignals to one or more secondary apparatuses 2, 3. The main apparatus 1can be installed on a vehicle 4, for example a motorcycle, while eachsecondary apparatus 2, 3 is arranged, on a protective garment 5, 6 of auser 7, 8, for example the driver and the passenger of vehicle 4. Theprotective garments 5, 6 are jackets which can be worn by users 7, 8 andare provided with one or more airbags suitable for being inflated by gasgenerators controlled by a secondary apparatus 2, 3 in case of accident.The main apparatus 1 is connected to one or more main sensors 9, 10, inparticular acceleration sensors on three axes x, y, z mounted on aportion of vehicle 4 which can move with respect to the seats for theusers 7, 8, for example a pair of acceleration sensors mounted on thefork of the motorcycle on the two sides of the front wheel.

The main apparatus 1 is further connected to one or more auxiliarysensors 11, 12, in particular a pair of acceleration sensors on at leastone axis y, which are mounted on a portion of vehicle 4 which is fixedwith respect to the seats for users 7, 8, for example under the saddleof the motorcycle. The auxiliary sensors 11, 12 are arranged one besidethe other in vehicle 4. The main sensors 9, 10 and/or the auxiliarysensors 11, 12 can be connected to the main apparatus by means of cablesor with wireless means.

Axis x is a substantially longitudinal axis, namely substantiallyparallel to the main displacement direction of vehicle 4, axis y is asubstantially transversal and horizontal axis, namely substantiallyperpendicular to axis x, while axis z is substantially transversal andvertical, namely substantially perpendicular to axis x and axis y. Thesystem is mounted on a motorcycle 4 but it may be mounted also on otherland, sea and air vehicles, for example bicycles, motor vehicles,horses, skis, sledges, boats, airplanes, helicopters, parachutes, etc.

Referring to FIG. 3, it is seen that the main apparatus 1 comprises amain control unit CU1, in particular comprising a dual coremicrocontroller, for example microcontroller Freescale MC9S12XE-LQFP144,which is connected to one or more anti-aliasing filters AF1, AF2, AF3 inturn connected to connectors C for connecting the main control unit CU1to the main sensors 9, 10 and to the auxiliary sensors 11, 12. A firstcore C11, for example a HCS12 core, of the main control unit CU1 isconnected in a bidirectional manner through an interface SPI and serialand/or parallel lines SPL to a clock CK and to one or more non-volatiledigital memories, for example a flash memory FM and a FRAM memory.

The first core C11 of the main control unit CU1 is further connected ina bidirectional manner through an interface SPI and serial and/orparallel lines SPL to a first main transceiver T11 suitable fortransmitting and receiving control signals and/or activation signals ona first radio channel with a first frequency comprised between 2400 and2483.5 MHz. The anti-aliasing filters AF1, AF2, AF3 are connected to thefirst core C11 through a first analog-to-digital converter A1, so thatthe acceleration signals Axyz transmitted by the main sensors 9, 10 andthe acceleration signals Ay transmitted by the auxiliary sensors 11, 12can be processed by the first core C11. A second core C12, for examplean Xgate core, of the main control unit CU1 is connected in abidirectional manner through an interface SPI and serial and/or parallellines SPL to a second main transceiver T12 suitable for transmitting andreceiving control signals and/or activation signals on a second radiochannel with a second frequency different from the first frequency, inparticular comprised between 868 and 868.6 MHz or between 902 and 928MHz. The anti-aliasing filters AF1, AF2, AF3 are connected to the secondcore C12 through a second analog-to-digital converter A2, so that theacceleration signals Axyz transmitted by the main sensors 9, 10 and theacceleration signals Ay transmitted by the auxiliary sensors 11, 12 canbe simultaneously processed also by the second core C12. One or bothmain transceivers T11 and/or T12 are connected to the first core C11 orto the second core C12, respectively, by means of interrupt lines IRQ1,IRQ2 for transmitting interrupt signals to cores C11, C12 of the maincontrol unit CU1 according to control signals received by the maintransceivers T11 and/or T12. The anti-aliasing filters AF1, AF2, AF3 arepreferably Sallen-Key low-pass filters with a cutoff frequency equal toa 143 Hz±10% and a Q factor equal to 0.74±10%. The analog-to-digitalconverters A1, A2 sample the acceleration signals Axyz and Ay at asampling frequency comprised between 1400 and 1600 Hz.

The main control unit CU1 can be connected also to a speed sensor SS,for example the same device used for determining the speed in vehicle 4,so that the main control unit CU1 can obtain a longitudinal speed signalVx corresponding to the speed of vehicle 4. The main control unit CUTcan be connected through a CAN bus also to a CAN (Controller AreaNetwork) interface CI1 for the connection to another CAN interface (notshown) present in vehicle 4 and/or to CAN maintenance devices MD for themaintenance of the main apparatus 1.

The main control unit CU1 can be connected through a watchdog line WLalso to a supervision device SD1, in particular a reset circuit with anadjustable timeout delay such as for example the MAX6753 integratedcircuit of Maxim Semiconductor, which can transmit reset signals to themain transceivers T11 and/or 112 through reset lines RST1, RST2, as wellas an enabling signal of the second core C12 through an enabling line ELaccording to control signals received by the main control unit CU1through the watchdog line WL and processed by the supervision deviceSD1. The main control unit CU1 can transmit self-test signals to themain sensors 9, 10 and/to the auxiliary sensors 11, 12 through self-testlines SL. The main control unit CU1 can be connected through a serialbus SB to an input/output controller IO in turn connected to a userinterface UI, for example a LCD or LED display and/or a keyboard, sothat user 7 can receive and/or transmit information from the mainapparatus 1 and/or to the main apparatus 1. The main control unit CU1and/or the supervision device SD1 can transmit status signals to theinput/output controller IO or directly to the user interface UI throughlines L1, L2, L3 and L4. Also the user interface UI can transmit statussignals to the main control unit CU through a line L5.

A power supply PS1 receives electric current from an external batteryEB, for example the same 12V battery of vehicle 4, for supplying acontinuous electric current to the components of the main apparatus 1 bymeans of 3.3V, 5V and 12V lines. The power supply PS1 can also receivean ignition signal K from the ignition key IK of vehicle 4. The powersupply PS1 transmits to the main control unit CU1 the ignition signal Kand a signal TS corresponding to the temperature of the power supplyPS1. A plurality of connectors C connects the main apparatus 1 with theexternal components. Further control lines connect the power supply PS1to the main control unit CU1 for the control of the voltages on thelines inside and/or outside the main apparatus 1.

Referring to FIG. 4, it is seen that the secondary apparatus 2, 3comprises a secondary control unit CU2, in particular comprising a dualcore microcontroller, for example microcontroller FreescaleMC9S12XE-LQFP112. A first core C21, for example a HCS12 core, of thesecondary control unit CU2 is connected in a bidirectional mannerthrough an interface SPI and serial and/or parallel lines SPL to anon-volatile digital memory, for example a flash memory FM. The firstcore C21 of the secondary control unit CU2 is further connected in abidirectional manner through an interface SPI and serial and/or parallellines SPL to a first secondary transceiver T21 suitable for transmittingand receiving control signals and/or activation signals from the firstmain transceiver T11 of the main apparatus 1 on the first radio channelwith a first frequency comprised between 2400 and 2483.5 MHz. A secondcore C22, for example an Xgate core, of the secondary control unit CU2is connected in a bidirectional manner through an interface SPI andserial and/or parallel lines SPL to a second secondary transceiver T22suitable for transmitting and receiving control signals and/oractivation signals from the second main transceiver T12 of the mainapparatus 1 on the second radio channel with a second frequencydifferent from the first frequency, in particular comprised between 868and 868.6 MHz or between 902 and 928 MHz. One or both secondarytransceivers T21 and/or T22 are connected to the first core C21 or tothe second core C22, respectively, by means of interrupt lines IRQ1,IRQ2 for transmitting interrupt signals to cores C21, C22 of thesecondary control unit CU2 according to control signals received by thesecondary transceivers T21 and/or T22.

The first core C21 and the second core C22 of the secondary control unitCU2 are connected through a channel switch CS to at least one firingcontroller FC, in turn connected through connectors C to one or more gasgenerators GG1, GG2 for driving one or more airbags AB1, AB2 of theprotective garment 5, 6 by means of activation signals transmittedthrough firing lines FL from the first core C21 and/or from the secondcore C22 according to activation signals received by the secondarytransceivers T21 and/or T22. The first core C21 and the second core C22are connected in a bidirectional manner through an interface SPI andserial and/or parallel lines SPL to the channel switch CS forcontrolling the switching of the firing lines coming from the first coreC21 and from the second core C22.

The secondary control unit CU2 of the secondary apparatus 2, 3 isconnected to a smart-card reader SR for reading an identification codestored in a smart-card. SC ad associated to a reference code stored in anon-volatile memory, in particular in the flash memory FM, of the mainapparatus 1. The identification code in the smart-card SC comprises inturn a first sub-code associated to the reference code stored in themain apparatus 1 and a second sub-code which indicates the position ofuser 7, 8 on vehicle 4, for example the position of driver 7 orpassenger 8.

The secondary control unit CU2 of the secondary apparatus 2, 3 can beconnected through a CAN bus also to a CAN (Controller Area Network)interface CI2 for the connection to CAN maintenance devices MD for themaintenance of the secondary apparatus 2, 3.

The secondary control unit CU2 can be connected through a watchdog lineWL also to a supervision device SD2, in particular a reset circuit withan adjustable timeout delay such as for example the MAX6753 integratedcircuit of Maxim Semiconductor, which can transmit reset signals to thesecondary control unit CU2 through a reset line RST. The supervisiondevice SD2 of the secondary apparatus 2, 3 is also connected to thechannel switch CS for transmitting a switching signal to the channelswitch CS, so as to switch the connection from the firing line FL fromthe first core C21 to the firing line FL from the second core C22 oreven interrupting lines FL for preventing the driving of the protectivegarment 5, 6 in case of malfunction. The supervision device SD2 is alsoconnected to the second core C22 for transmitting an enabling signal ora disabling signal, which can be sent through the second secondarytransceiver T22 to the main apparatus 1.

The secondary control unit CU2 of the secondary apparatus 2, 3 can beconnected to a vibrating device VD for signaling to user 7, 8 the statusof the secondary apparatus 2, 3, for example malfunctions or anomalies,by means of vibrations of the protective garment 5, 6. The secondarycontrol unit CU2 of the secondary apparatus 2, 3 can be connected bymeans of a line SE to a switch SW of the protective garment 5, 6 for theactivation or the deactivation of the secondary control unit CU2.

A power supply PS2 of the secondary apparatus 2, 3 is connected to anexternal battery EB, for example the same 12V battery of vehicle 4and/or to an internal 3.2V battery IB, preferably rechargeable by thepower supply PS2, which supplies a continuous electric current to thecomponents of the secondary apparatus 2, 3 by means of 3.3V, 5V, 12V and24V lines. The control of the recharge of the internal battery IB iscarried out by the secondary control unit CU2 by means of lines L6, L7connecting the power supply PS2 to the secondary control unit CU2. Thepower supply PS2 is connected to the firing controller FC by means of aline which carries a voltage sufficient for driving the gas generatorsGG1, GG2, in particular a 24V line. The voltage on the 24V line can beactivated or deactivated by the secondary control unit CU2 and/or by thesupervision device SD2 by means of voltage enabling and/or disablingsignals which are transmitted to the power supply PS2 through lines FE,FD. The status of batteries EB and/or IB connected to the power supplyPS2 can be controlled by pushing a button BB connected to the powersupply PS2 and/or to the secondary control unit CU2. When user 7, 8pushes button BB, the power supply PS2 sends through a line BC a statussignal to the secondary control unit CU2, which in turn turns on abattery light BL according to this status signal.

The power supply PS2 is connected to switch SW by means of line SE forturning on and off the secondary apparatus 2, 3. The power supply PS2transmits to the secondary control unit CU2 a signal TS corresponding tothe temperature of the power supply PS2. The secondary apparatus 2, 3 isconnected with the external components through a plurality of connectorsC. Further control lines connect the power supply PS2 to the secondarycontrol unit CU2 for controlling the voltages on the lines inside and/oroutside the secondary apparatus 2, 3.

Referring to FIG. 5, it is seen that when the main apparatus 1 and/orthe secondary apparatuses 2, 3 are turned on, the system is in aninitial mode IM, after which the control units CU1, CU2 of the mainapparatus 1 and of the secondary apparatuses 2, 3 carry out a checkphase CHK for verifying that all the components of the main apparatus 1and of the secondary apparatuses 2, 3 work properly. The control unitsCU1, CU2 of the main apparatus 1 and of the secondary apparatuses 2, 3work in a normal mode NM, in which the main transceivers T11, T12 of themain apparatus 1 are connected with the secondary transceivers T21, T22of one or more secondary apparatuses 2, 3, if they pass the check phaseCHK and they are not in a maintenance mode MM, which is detected if oneor more maintenance devices MD are connected to the control units CU1and/or CU2.

If the control units CU1, CU2 of the main apparatus 1 and of thesecondary apparatuses 2, 3 do not pass the check phase CHK and are inthe maintenance mode MM, the main control unit CU1 shows on the userinterface UI a system fault signal SFS and, if airbags AB1, AB2 of oneor both secondary apparatuses 2, 3 have been activated, also amaintenance signal MMS. At the same time, the secondary control unit CU2of the secondary apparatuses 2, 3 drives the vibrating device VD.

During the maintenance mode MM the control units CU1, CU2 of the mainapparatus 1 and/or of the secondary apparatuses 2, 3 transmit and/orreceive data from the maintenance devices MD, after which they switch toa stop mode SM, in which the main apparatus 1 and the secondaryapparatuses 2, 3 are deactivated.

During the normal mode NM the control units CU1, CU2 of the mainapparatus 1 and of the secondary apparatuses 2, 3 carry out a normalworking cycle, in which the control unit CU1 of the main apparatus 1 maytransmit an activation signal to the secondary apparatuses 2, 3 foractivating airbags AB1, AB2 if an accident is detected, but also verifywhether a system fault occurred, in which case they switch to a systemfault mode SFM, or whether a system degradation occurred, in which casethey switch to a degraded mode DM, or whether a system interruptionoccurred, in which case they switch to the stop mode SM.

During the degraded mode DM the control units CU1, CU2 of the mainapparatus 1 and of the secondary apparatuses 2, 3 carry out a normalworking cycle, in which the control unit CU1 of the main apparatus 1 maystill transmit an activation signal to the secondary apparatuses 2, 3for activating airbags AB1, AB2 if an accident is detected, but alsoverify whether a system fault occurred, in which case they switch to asystem fault mode SFM, or whether a system interruption occurred, inwhich case they switch to the stop mode SM. In the degraded mode DM themain control unit CU1 shows on the user interface UI a degraded modesignal DMS. At the same time, the secondary control unit CU2 of thesecondary apparatuses 2, 3 drives the vibrating device VD.

The control units CU1, CU2 of the main apparatus 1 and of the secondaryapparatuses 2, 3 switch to the system fault mode SFM also if they do notpass the check phase CHK and if they are not in the maintenance mode MM.In the system fault mode SFM the main control unit CU1 turns off on theuser interface UI the degraded mode signal DMS, if it was on, and turnson on the user interface UI the system fault signal SFS. At the sametime, the secondary control unit CU2 of the secondary apparatuses 2, 3drives the vibrating device VD. In the system fault mode SFM the maincontrol unit CU1 shows on the user interface UI also a maintenancesignal MMS, if airbags AB1, AB2 of one or both secondary apparatuses 2,3 have been activated. During the system fault mode SFM the controlunits CU1, CU2 of the main apparatus 1 and of the secondary apparatuses2, 3 verify whether a system interruption occurred, in which case theyswitch to the stop mode SM.

Referring to FIG. 6, it is seen that the main apparatus 1 and thesecondary apparatuses 2, 3, in the respective initial mode IM1, IM2,IM3, carry out a power-on phase ON1, ON2, ON3 and the check phase CHK1,CHK2, CHK3 in the above described way. After the initial mode IM1, themain apparatus 1 in a first normal mode NM1 sends control signals on thefirst radio channel through the first main transceiver T11 and on thesecond radio channel through the second main transceiver T12 forverifying the power-on of the secondary apparatuses 2, 3. If thesecontrol signals are received by the first secondary transceiver T21 andby the second secondary transceiver T22 of the secondary apparatuses 2and/or 3 which have carried out the initial mode IM2 and/or IM3, themain apparatus 1 and the secondary apparatuses 2 and/or 3 carry out apairing phase PP12 and/or PP13, respectively, in which the secondaryapparatuses 2 and/or 3 transmit to the main apparatus 1 the respectiveidentification codes stored in the smart-cards SC inserted in therespective smart-card readers SR, so that the control unit CU1 of themain apparatus 1 can compare the identification codes received by thesecondary apparatuses 2 and/or 3 with the reference code stored in thenon-volatile memory FM. If this comparison is positive, the mainapparatus 1 is paired with the secondary apparatuses 2 and/or 3, so thatthe control unit CU1 of the main apparatus 1 periodically transmits andreceives control signals with the control unit CU2 of the secondaryapparatuses 2 and/or 3 through transceivers T11, T12, T21 and T22. Afterthe pairing phase PP12 and/or PP13 the secondary apparatuses 2 and/or 3are connected with the main apparatus 1 in an enabled protection phaseEP12 and/or EP13, in which the control unit CU2 of the secondaryapparatuses 2 and/or 3 can activate airbags AB1, AB2 according toactivation signals transmitted by the main apparatus 1. The enabledprotection phase EP12 and/or EP13 is carried out in a second normal modeNM12 in which the main apparatus 1 and only the first secondaryapparatus 2 are on, or in a third normal mode NM13 in which the mainapparatus 1 and only the second secondary apparatus 3 are on, or in afourth normal mode NM123 in which the main apparatus and both secondaryapparatuses 2, 3 are on. In all the normal modes NM1, NM12, NM13 andNM123 the main apparatus 1 sends control signals from the first maintransceiver T11 and/or from the second main transceiver T12 forverifying the power-on of the secondary apparatuses 2, 3. If the firstsecondary transceiver T21 and the second secondary transceiver T22 ofthe secondary apparatuses 2 and/or 3 do not reply to the control signalstransmitted by the main apparatus 1, the latter disables the pairingwith the secondary apparatus 2 and/or 3 which does not reply, switchingthen from the fourth normal mode NM123 to the second or third normalmode NM12 or NM13, or switching from the second or third normal modeNM12 or NM13 to the first normal mode NM1.

Referring to FIG. 7, it is seen that in the second, third or fourthnormal mode NM12, NM13 or NM123, namely in a normal mode in which themain apparatus 1 is paired with at least one secondary apparatus 2, 3 inan enabled protection phase EP12 and/or EP13, the main control unit CU1of the main apparatus 1 in a signal acquisition phase SAP acquires theacceleration signals Axyz and/or Ay from the main sensors 9, 10 and/orfrom the auxiliary sensors 11, 12 through the anti-aliasing filters AF1,AF2, AF3. If at least one of the values of the signals Axyz and/or Ay isoutside a range of correct values stored in a non-volatile memory FMand/or FRAM, the main control unit CU1 of the main apparatus 1 verifiesthe proper working of the of the main sensors 9, 10 and/or of theauxiliary sensors 11, 12 by sending a self-test signal through theself-test lines SL. If both main sensors 9, 10 or both auxiliary sensors11, 12 do not reply to the self-test signal, the main control unit CU1switches the main apparatus 1 to the system fault mode SFM, otherwise ifonly one of the main sensors 9, 10 and/or of the auxiliary sensors 11,12 replies to the self-test signal, the main control unit CU1 switchesthe main apparatus 1 to a first degraded mode DM1, in which the mainsensor 9, 10 and/or the auxiliary sensor 11, 12 which does not reply tothe self-test signal is excluded.

If instead the values of the acceleration signals Axyz and/or Ay arewithin a valid range, the main control unit CU1 of the main apparatus 1in an impact detection phase IDP detects whether an impact occurredaccording to the acceleration signals Axyz sent by the main sensors 9,10. If an impact is not detected in the impact detection phase IDP, themain control unit CU1 in a speed detection phase VDP detects whethervehicle 4 is moving with a longitudinal speed Vx higher than a speedthreshold VT, for example comprised between 2 and 10 m/s, stored in anon volatile memory FM and/or FRAM. The main control unit CU1 of themain apparatus 1 can obtain the longitudinal speed Vx by means of thespeed sensor SS, by means of other speed or acceleration sensors or inanother way, in particular by verifying whether the transversalaccelerations Ay and/or the vertical accelerations Az in theacceleration signals Axyz sent by the main sensors 9, 10 exceedacceleration thresholds stored in a non-volatile memory FM and/or FRAM.If the longitudinal speed Vx of vehicle 4 is higher than the speedthreshold VT, the main control unit CU1 of the main apparatus 1 in aslide detection phase SDP detects whether a slide occurred according tothe acceleration signals Ay sent by the auxiliary sensors 11, 12. If animpact is detected in the impact detection phase IDP or a slide isdetected in the slide detection phase SDP, the main control unit CU1 ofthe main apparatus 1 in an accident signaling phase ASP sends anactivation signal AS to the secondary apparatuses 2, 3 for a number k oftimes through the first main transceiver T11 and/or the second maintransceiver T12, after which, in an accident memory phase AMP, stores inthe non-volatile memory FRAM all the available data relating to themoment of the accident detection and/or to the acceleration signals Axyzand/or Ay sent by the main sensors 9, 10 and/or by the auxiliary sensors11, 12 in the moments preceding the accident, for example during aperiod MT longer than 250 ms before the accident.

The acceleration signals Axyz and/or Ay are stored at each samplingcycle into a circular buffer in the non-volatile memory FRAM, so thatthe accident memory phase AMP consists of the stoppage of the writing inthe non-volatile memory FRAM, which thus is accessible in a subsequentmoment by means of a maintenance device MD for detecting the causes ofthe accident.

When the first secondary transceiver T21 and/or the second secondarytransceiver T22 of the secondary apparatuses 2, 3 receive the activationsignal AS from the main apparatus 1, the secondary control unit CU2 ofthe secondary apparatuses 2, 3 sends the activation signals through thefiring lines FL to the gas generators GG1, GG2 for activating airbagsAB1, AB2.

Referring to FIG. 8, it is seen that in the impact detection phase IDPthe acceleration signals Axyz sent by the main sensors 9, 10 andfiltered by the anti-aliasing filters AF1, AF2 are processed by the maincontrol unit CU1 of the main apparatus 1 so as to obtain axialacceleration values Ax, Ay and Az on the three axes x, y and z, whichare in particular obtained with a mean, for example an arithmetic mean,of the three pairs of axial accelerations Ax1 and Ax2, Ay1 and Ay2, Az1and Az2, oriented along axes substantially parallel, of the twoacceleration signals Axyz sent by the main sensors 9, 10. One or moreaxial acceleration values Ax, Ay and Az are filtered by the main controlunit CU1 by means of first high-pass filter stages HPF1 having a cutofffrequency comprised between 0.5 and 15 Hz, in particular between 4 and 6Hz, so as to cancel possible axial acceleration values which depend onlyon the movement of vehicle 4, after which the main control unit CU1calculates a direction value D proportional to the square of thevertical acceleration Az and inversely proportional to the sum of thesquares of the three axial accelerations Ax, Ay and Az, in particularwith the formula D=Az²/(Ax²+Ay²+Az²). The direction value D is filteredby the main control unit CU1 by a first low-pass filter stage LPF1having a cutoff frequency comprised between 1 and 100 Hz, in particularbetween 20 and 40 Hz, so as to obtain a filtered direction value D whichis not influenced by anomalous peaks in the acceleration signals Axyz.The main control unit CU1 calculates an energy threshold ET and a stressthreshold ST by means of the filtered direction value D, in particularthrough a pair of energy constants ET1, ET2 and a pair of stressconstants ST1, ST2, which are obtained in an experimental manner and arestored in a non-volatile memory FM and/or FRAM of the main apparatus 1.The energy threshold ET and the stress threshold ST are proportional tothe square of the filtered direction value D, to a constant ET2 or ST2,and/or to the difference of the pairs of constants ET1 and ET2, ST1 andST2, in particular by means of the formulae ET=ET2+D²*(ET1−ET2) and/orST=ST2+D²*(ST1−ST2).

At least two axial acceleration values, in particular the horizontalacceleration values Ax, Ay, are also integrated by the main control unitCU1 by means of integration phases IPx, IPy for obtaining axialacceleration integral values IAx, IAy, which are then filtered in secondhigh-pass filter stages HPF2 having a cutoff frequency comprised between0.05 and 1 Hz, so as to cancel possible initialization errors. The maincontrol unit CU1 calculates then an energy modulus EM according to theaxial acceleration integral values IAx, IAy, in particular bycalculating an energy modulus EM proportional to the sum of the squaresof the axial acceleration integral values IAx, IAy, for example with theformula EM=(IAx²+IAy²).

The main control unit CU1 calculates a stress intensity SI according toat least two axial acceleration values, in particular to the horizontalacceleration values Ax, Ay, by calculating a stress intensity SIproportional to the sum of the squares of the axial acceleration valuesAx, Ay, for example with the formula SI=Ax²+Ay², after which the valueof the stress intensity SI is held by a peak holder phase PH whichlimits the slope with which this value returns to the value obtained bythe acceleration values detected by the main sensors 9, 10 after a peak,so as to compensate the delay between the calculations of the stressintensity SI and of the energy modulus EM, which delay is caused by theintegration operation in the integration phases IPx, IPy. A possibleimplementation of the peak holder phase PH in the main control unit CU1can be the following:if (SI(t)<(SI(t−1)−DCY)) then (SI(t)=(SI(t−1)−DCY)),

wherein SI(t) is the stress intensity SI during the time and DCY is adecay constant greater than 100 g²/ms, in particular comprised between990 and 1010 g²/ms, wherein g is the acceleration of gravity and ms aremilliseconds.

If the main control unit CU1 verifies that at a given instant the stressintensity SI is greater than the stress threshold ST and simultaneouslythe energy modulus EM is greater than the energy threshold ET, the maincontrol unit CU1 of the main apparatus 1 sends the activation signal ASto the control units CU2 of the secondary apparatuses 2, 3.

Referring to FIG. 9, it is seen that in the slide detection phase SDPthe axial acceleration signals Ay1, Ay2 sent by the auxiliary sensors11, 12 and filtered by the anti-aliasing filter AF3 are processed by themain control unit CU1 of the main apparatus 1 in second low-pass filterstages LPF2 having a cutoff frequency comprised between 100 and 200 Hz,in particular between 140 and 160 Hz, so as to eliminate possibleanomalous peaks. If however after a given waiting time WT, for examplecomprised between 100 and 300 ms, signals Ay1 or Ay2 are always greaterthan an acceleration threshold AT, for example comprised between 0.5 and1 g (acceleration of gravity), stored in a non-volatile memory FM and/orFRAM, then the main control unit CU1 of the main apparatus 1 sends theactivation signal AS to the control units CU2 of the secondaryapparatuses 2, 3.

Referring to FIG. 10, it is seen that in the normal mode NM the controlunits CU1, CU2 of the main apparatus 1 and of the secondary apparatuses2, 3 verify whether the main transceivers T11, T12 and the secondarytransceivers T21, T22 communicate properly between each other.

In particular, the first core C11 of the main control unit CU1 of themain apparatus 1 receives and processes the acceleration signals Axyz,Ay and sends on the first radio channel through the first maintransceiver T11 the control signals to the first secondary transceiverT21 of the secondary apparatuses 2, 3, in which the first core C21 ofthe secondary control unit, CU2 receives the control signals on thefirst radio channel from the first secondary transceiver T21 and sendsan activation signal to the gas generators GG1, GG2 if it receives fromthe main apparatus 1 also activation signals. In the meanwhile, thesecond core C12 of the main control unit CU1 of the main apparatus 1 andthe second core C22 of the secondary control unit CU2 of the secondaryapparatuses 2, 3 periodically send on the second radio channel controlsignals from the second main transceiver T12 and from the secondsecondary transceiver T22, respectively, which control signals arereceived by the second secondary transceiver T22 and by the second maintransceiver T12, respectively, for being processed by the second coreC22 of the secondary control unit CU2 and by the second core C12 of themain control unit CU1.

If the first main transceiver T11 and/or the first secondary transceiverT21 do not receive the control signals on the first radio channel, themain control unit CU1 of the main apparatus 1 and/or the secondarycontrol unit CU2 of the secondary apparatuses 2, 3 send on the secondradio channel a degraded mode signal DMS from the second maintransceiver T12 and/or from the second secondary transceiver T22 to thesecondary apparatuses 2, 3 and/or to the main apparatus 1, respectively,so that the control units CU1, CU2 of the main apparatus 1 and of thesecondary apparatuses 2, 3 switch from the normal mode NM to a seconddegraded mode DM2, in which the control signals are transmitted on thesecond radio channel by the second main transceiver T12 of the mainapparatus 1 and/or by the second secondary transceiver T22 of thesecondary apparatuses 2, 3. If also the second main transceiver T12 andthe second secondary transceiver T22 do not receive the control signalson the second radio channel, the control units CU1, CU2 of the mainapparatus 1 and of the second apparatuses 2, 3 switch from the seconddegraded mode DM2 to the system fault mode SFM.

If instead the first main transceiver T11 and the first secondarytransceiver T21 receive the control signals on the first radio channel,but the second main transceiver T12 and/or the second secondarytransceiver T22 do not receive the control signals on the second radiochannel, the main control unit CU1 of the main apparatus 1 and/or thesecondary control unit CU2 of the secondary apparatuses 2, 3 send on thefirst radio channel a degraded mode signal DMS from the first maintransceiver T11 and/or from the first secondary transceiver T21 to thesecondary apparatuses 2, 3 and/or to the main apparatus 1, respectively,so that the control units CU1, CU2 of the main apparatus 1 and of thesecondary apparatuses 2, 3 switch from the normal mode NM to a thirddegraded mode DM3, in which the control signals are transmitted on thefirst radio channel by the first main transceiver T11 of the mainapparatus 1 and/or by the first secondary transceiver T21 of thesecondary apparatuses 2, 3, while no control signals are transmitted onthe second radio channel. If also the first main transceiver T11 and thefirst secondary transceiver T21 do not receive the control signals onthe first radio channel, the control units CU1, CU2 of the mainapparatus 1 and of the second apparatuses 2, 3 will switch from thethird degraded mode DM3 to the system fault mode SFM.

Possible modifications and/or additions may be made by those skilled inthe art to the hereinabove disclosed and illustrated embodiment whileremaining within the scope of the following claims. In particular,further embodiments of the invention may comprise the technical featuresof one of the following claims with the addition of one or moretechnical features, taken singularly or in any mutual combination,disclosed in the text and/or illustrated in the drawings.

The invention claimed is:
 1. A main apparatus for personal protection,which comprises: at least one main control unit which is connected toone or more main sensors and to a first main transceiver fortransmitting and receiving to or from at least one secondary apparatus,on a first radio channel, control signals and/or activation signals,wherein the at least one main control unit is also connected to a secondmain transceiver for transmitting and receiving to or from said at leastone secondary apparatus on a second radio channel said control signalsand/or activation signals, which said main apparatus is suitable forcommunicating on at least two different radio channels with said atleast one secondary apparatuses.
 2. The main apparatus according toclaim 1, wherein the one or more main sensors are adapted suitable forbeing to be mounted on a portion of a vehicle which can move withrespect to seats for users of the vehicle.
 3. The main apparatusaccording to claim 1, wherein the at least one main control unit isfurther connected also to one or more auxiliary sensors adapted suitablefor being to be mounted on a portion of a vehicle which is fixed withrespect to seats for users of the vehicle.
 4. A motorcycle comprising: afork of a front wheel, and a saddle, wherein the saddle comprises themain apparatus according to claim 3, wherein the one or more mainsensors are mounted on the fork on two sides of the front wheel and theone or more auxiliary sensors are mounted under the saddle.
 5. The mainapparatus according to claim 1, wherein said one or more main sensorsare acceleration sensors on one or more axes substantially perpendicularto each other and send axial acceleration signals.
 6. The main apparatusaccording to claim 1, wherein said one or more main sensors areconnected to the at least one main control unit through one or moreanti-aliasing filters.
 7. The main apparatus according to claim 6,wherein the one or more anti-aliasing filters are Sallen-Key low-passfilters with a cutoff frequency equal to 143 Hz±10% and a Q factor equalto a 0.74±10%.
 8. The main apparatus according to claim 1, wherein theat least one main control unit is connected also to a speed sensor whichsends longitudinal speed signals relating to a vehicle.
 9. The mainapparatus according to claim 1, wherein the at least one main controlunit is connected to the one or more main sensors through self-testlines for transmitting self-test signals to the one or more mainsensors.
 10. The apparatus according to claim 1, wherein a frequency ofthe first radio channel is comprised between 2400 MHz and 2483.5 MHz.11. The apparatus according to claim 1, wherein the at least one maincontrol unit comprises a dual core microcontroller, wherein a first coreof the at least one main control unit is connected to the first maintransceiver and a second core of the at least one main control unit isconnected to the second main transceiver.
 12. The apparatus according toclaim 11, wherein the first core is a HCS12 core and the second core isa Xgate core.
 13. The apparatus according to claim 11, wherein one orboth transceivers of the first and second main transceivers areconnected to the first core or the second core, respectively, by meansof interrupt lines for transmitting interrupt signals to the first andsecond cores of the at least one main control unit according to thecontrol signals received from the first and second main transceivers.14. The apparatus according to claim 11, wherein the first core and thesecond core of the at least one main control unit are connected to afiring controller through firing lines and a channel switch, wherein thefirst core and the second core are also connected to the channel switchfor controlling switching between the firing lines.
 15. The apparatusaccording to claim 1, wherein the at least one main control unit isconnected through a CAN bus to a CAN interface for connection to anotherCAN interface of a vehicle and/or to CAN maintenance devices.
 16. Theapparatus according to claim 1, wherein the at least one main controlunit is connected to a supervision device which can transmit resetsignals to the first and second main transceivers and/or to the at leastone main control unit through reset lines.
 17. The apparatus accordingto claim 16, wherein the supervision device can transmit an enablingsignal of a second core of the at least one main control unit through anenabling line according to control signals received from the at leastone main control unit and processed by the supervision device.
 18. Theapparatus according to claim 16, wherein the supervision device is alsoconnected to a channel switch for transmitting a switching signal to thechannel switch.
 19. The apparatus according to claim 16, wherein thesupervision device is a reset circuit with an adjustable timeout delay.20. The apparatus according to claim 1, wherein the at least one maincontrol unit is connected to a vibrating device.
 21. A vehicle,comprising the main apparatus according to claim
 1. 22. The mainapparatus according to claim 1, wherein: the at least one main controlunit is connected to the first main transceiver through a first line,and to the second main transceiver through a second line.
 23. The mainapparatus according to claim 22, wherein the first line is a firstinterrupt line, and the second line is a second interrupt line.
 24. Themain apparatus according to claim 23, wherein the second maintransceiver is a backup of the first main transceiver.
 25. A secondaryapparatus for personal protection, which comprises: at least onesecondary control unit which is connected to at least one firingcontroller and to a first secondary transceiver for transmitting andreceiving to or from a main apparatus on a first radio channel controlsignals and/or activation signals, wherein the at least one secondarycontrol unit is also connected to a second secondary transceiver fortransmitting and receiving to or from said main apparatus on a secondradio said channel control signals and/or activation signals, the atleast one secondary control unit is connected to the first secondarytransceiver through a first interrupt line, and to the second secondarytransceiver through a second interrupt line.
 26. The secondary apparatusaccording to claim 25, wherein the at least one secondary control unitis connected to a smart-card reader for reading an identification codestored in a smart-card and transmitting this identification code from asecondary transceiver.
 27. A protective garment, comprising thesecondary apparatus according to claim 25, wherein the at least onefiring controller is connected to one or more gas generators connectedto one or more airbags.
 28. A system for personal protection, comprisinga main apparatus comprising: at least one main control unit which isconnected to one or more main sensors and to a first main transceiverfor transmitting and receiving to or from at least one secondaryapparatus, on a first radio channel, control signals and/or activationsignals, wherein the at least one main control unit is also connected toa second main transceiver for transmitting and receiving to or from saidat least one secondary apparatus on a second radio channel said controlsignals and/or activation signals, which main apparatus is suitable forcommunicating on at least two different radio channels with one or moresecondary apparatuses according to claim
 9. 29. A process configured tobe carried out by the system according to claim 28, wherein in a normalmode, the at least one main control units of the main apparatus and ofthe at least one secondary apparatuses transmit control signals throughthe main transceivers and secondary transceivers on two radio channels.30. The process according to claim 29, wherein if a first maintransceiver and/or a first secondary transceiver do not receive thecontrol signals on a first radio channel, the at least one main controlunit of the main apparatus and/or at least one secondary control unit ofthe at least one secondary apparatuses send on a second radio channel, adegraded mode signal from a second main transceiver and/or from a secondsecondary transceiver to the at least one secondary apparatuses and/orthe main apparatus, respectively, so that the at least one main controlunit of the main apparatus and of the at least one secondary apparatusesswitch from the normal mode to a degraded mode, wherein the controlsignals are transmitted on the second radio channel from the second maintransceiver of the main apparatus and/or from the second secondarytransceiver of the at least one secondary apparatuses.
 31. The processaccording to claim 30, wherein if the second main transceiver and/or thesecond secondary transceiver do not receive the control signals on thesecond radio channel, the at least one main control units of the mainapparatus and of the at least one secondary apparatuses switch from thedegraded mode to a system fault mode.
 32. The process according to claim29, wherein if a first main transceiver and a first secondarytransceiver receive the control signals on a first radio channel, but asecond main transceiver and/or a second secondary transceiver do notreceive the control signals on a second radio channel, the at least onemain control units of the main apparatus and/or the secondary controlunit of the secondary apparatuses send on the first radio channel adegraded mode signal from the first main transceiver and/or from thefirst secondary transceiver to the secondary apparatuses and/or the mainapparatus, respectively, so that the one or more control units of themain apparatus and of the secondary apparatuses switch from the normalmode to a degraded mode, wherein the control signals are transmitted onthe first radio channel from the first main transceiver of the mainapparatus and/or from the first secondary transceiver of the secondaryapparatuses.
 33. The process according to claim 32, wherein if also thefirst main transceiver and/or the first secondary transceiver do notreceive the control signals on the first radio channel, the at least onecontrol unit of the main apparatus and of the secondary apparatusesswitch from the degraded mode to a system fault mode.
 34. The secondaryapparatus according to claim 25, wherein a frequency of the first radiochannel is comprised between 2400 MHz and 2483.5 MHz.
 35. The secondaryapparatus according to claim 25, wherein the at least one secondarycontrol unit comprises a dual core microcontroller, wherein a first coreof the dual core microcontroller is connected to the first secondarytransceiver and the second core of the dual core microcontroller isconnected to the second secondary transceiver.
 36. The secondaryapparatus according to claim 35, wherein the first core is a HCS12 coreand the second core is a Xgate core.
 37. The secondary apparatusaccording to claim 35, wherein one or both of the secondary transceiversare connected to the first core or the second core, respectively, bymeans of interrupt lines for transmitting interrupt signals to the firstand second cores of the at least one secondary control unit according tothe control signals received from the secondary transceivers.
 38. Thesecondary apparatus according to claim 35, wherein the first core andthe second core of the at least one secondary control unit are connectedto a firing controller through firing lines and a channel switch,wherein the first core and the second core are also connected to thechannel switch for controlling switching between the firing lines. 39.The secondary apparatus according to claim 25, wherein the at least onesecondary control unit is connected through a CAN bus to a CAN interfacefor a connection to another CAN interface of a vehicle and/or to CANmaintenance devices.
 40. The secondary apparatus according to claim 25,wherein the at least one secondary control unit is connected to asupervision device which can transmit reset signals to the secondarytransceivers and/or to the at least one secondary control unit throughreset lines.
 41. The secondary apparatus according to claim 40, whereinthe supervision device can transmit an enabling signal of a second coreof the at least one secondary control unit through an enabling lineaccording to control signals received from the at least one secondarycontrol unit and processed by the supervision device.
 42. The secondaryapparatus according to claim 40, wherein the supervision device is alsoconnected to a channel switch for transmitting a switching signal to thechannel switch.
 43. The secondary apparatus according to claim 40,wherein the supervision device is a reset circuit with an adjustabletimeout delay.
 44. The secondary apparatus according to claim 25,wherein the at least one secondary control unit is connected to avibrating device.
 45. The secondary apparatus according to claim 25,wherein the second secondary transceiver is a backup of the firstsecondary transceiver.
 46. A secondary apparatus for personalprotection, which comprises: at least one secondary control unit whichis connected to at least one firing controller and to a first secondarytransceiver for transmitting and receiving to or from a main apparatuson a first radio channel control signals and/or activation signals,wherein the at least one secondary control unit is also connected to asecond secondary transceiver for transmitting and receiving to or fromsaid main apparatus on a second radio said channel control signalsand/or activation signals, which said secondary apparatus is suitablefor communicating on at least two different radio channels with saidmain apparatus.
 47. A main apparatus for personal protection, whichcomprises: at least one main control unit which is connected to one ormore main sensors and to a first main transceiver for transmitting andreceiving to or from at least one secondary apparatus, on a first radiochannel, control signals and/or activation signals, wherein the at leastone main control unit is also connected to a second main transceiver fortransmitting and receiving to or from said at least one secondaryapparatus on a second radio channel said control signals and/oractivation signals, the at least one main control unit is connected tothe first main transceiver through a first interrupt line, and to thesecond main transceiver through a second interrupt line.